Phantom Security Group
Phantom Security Group builds offensive security tooling for professional red teams, offering EvadeX for automated, signature-free payload generation and ApeX C2, an agentic command and control framework with native AI operator support via MCP and an on-agent Lua VM. Both products prioritize evasion against modern EDRs, with ApeX C2 deployable air-gapped, at the edge, or in the cloud.
- Cybersecurity
- Software Only
- Artificial Intelligence
- AI Agents
- Developer Tools
Funding
Founders
Founder details are not available yet.
Product
Problem
Red teams and penetration testers often find that mainstream offensive security tools are easily detected by modern endpoint detection and response (EDR) systems. Existing payload generators and command and control (C2) frameworks frequently rely on predictable techniques, such as executing shellcode from unbacked memory, which triggers common detection signatures and compromises the success of security assessments.
Solution
Phantom Security Group addresses this by delivering offensive security tooling designed for operational effectiveness against current defenses. The company offers EvadeX, an automated payload framework that generates signature-free binaries from user-supplied shellcode, and ApeX C2, a Stage 0 command and control framework that executes from backed memory to avoid standard detections. Both products are built with evasion as a core principle, ensuring they remain effective against mainstream EDR solutions. The platform is trusted in production by red teams, providing continuous updates to keep pace with evolving security controls.
Target Audience
The primary customers are professional red teams and penetration testers who require reliable, evasive tooling for authorized security assessments and need to bypass modern endpoint defenses.
Features
- EvadeX provides automated payload creation directly in the browser, simplifying the generation of custom loaders.
- Continuous evasion updates ensure the tools remain effective against current EDR signatures and detection techniques.
- ApeX C2 uses Stage 0 loader tradecraft and backed memory execution to bypass a common class of C2 detections.
- ApeX C2 includes a native AI operator via MCP (Model Context Protocol) and an on-agent Lua VM for post-exploitation scripting.
- Compile-time OPSEC with clean image-backed stacks reduces runtime indicators for stealthier operations.
- The platform offers a first-class API for EvadeX, enabling integration into existing red team workflows and automation pipelines.
- ApeX C2 can be deployed air-gapped, at the edge, or in the cloud for flexible operational environments.